How to test SSH key password on Ubuntu?

 How to test password for a private SSH key?

If id_rsa and id_rsa.pub is a keypair, we can execute (after we go to directory whey they reside like e.g.  cd ~/.ssh/):

$ ssh-keygen -y -f id_rsa

...which will prompt us to enter the password. If correct, this will output the public key.

-y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout.
-f filename  Specifies the filename of the key file.

If you download key pair from another machine, this operation might fail with error:

$ ssh-keygen -y -f id_rsa
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0664 for 'id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "id_rsa": bad permissions

To fix this change permissions on file:

$ chmod 400 id_rsa

If private key is not password protected, user will not be prompted to enter it.

 

Resources:

ssh keys - How do I verify/check/test/validate my SSH passphrase? - Stack Overflow

command line - How do I retrieve the public key from a SSH private key? - Ask Ubuntu 

How to generate SSH key pair on Ubuntu

To create SSH key pair we can use ssh-keygen:

$ ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

-t Specifies the type of key to create.  The possible values are “dsa”, “ecdsa”, “ed25519”, or “rsa”.

-b bits Specifies the number of bits in the key to create. For RSA keys, the minimum size is 1024 bits and the default is 3072 bits. Generally, 3072 bits is considered sufficient

-C comment Provides a new comment. This can be any string you want to help identify the key. As this keypair is unique and represents an identity of the (e.g. repository) user, I tend to use email format: user@domain

In case of Ed25519 there is no need to set the key size, as all Ed25519 keys are 256 bits. Older SSH clients and servers may not support these keys.

$ ssh-keygen -t ed25519 -C "your_email@example.com"

Example:

 

$ ssh-keygen -t rsa -b 4096 -C "bojan@xyz.com"
Generating public/private rsa key pair.
Enter file in which to save the key (/home/bojan/.ssh/id_rsa): ./key-pair--ec2--my-app
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./key-pair--ec2--my-app
Your public key has been saved in ./key-pair--ec2--my-app.pub
The key fingerprint is:
SHA256:Hft9KWA0w7qalQIRUFBX3MunZ8HJqm0LPXb2P/zcKKI 

bojan@xyz.com
The key's randomart image is:
+---[RSA 4096]----+
|   o=+ .o..      |
|      o  ...     |
|     .    o=+ .  |
|      .  .o=o*   |
|     .  S.oo+ .  |
|      .   =+.+  .|
|       . =o+++o..|
|        =.+o= o*.|
|       oE..o....O|
+----[SHA256]-----+

$ ls -la
-rw------- 1 bojan bojan 3434 May 27 17:27 key-pair--ec2--my-app
-rw-r--r-- 1 bojan bojan  749 May 27 17:27 key-pair--ec2--my-app.pub

To copy the contents of the id_rsa.pub file to clipboard:

$ xclip -sel clip < ~/.ssh/id_rsa.pub

Private key with default name (~/.ssh/id_rsa) should automatically be added to the SSH authentication agent. To check this we can start the ssh-agent and 

 

$ eval "$(ssh-agent -s)"

Agent pid 76155

$ ssh-add -l -E sha256

256 SHA256:DUXxZAyhbh68kJwex8rzHXQM2cKzSWadNqzW1KnPR3A bojan@xyz.com (ED25519)

If we have only key that does not have the default name, it might not have been added to SSH agent in which case the output would be:

$ ssh-add -l -E sha256

The agent has no identities.

To add the key to SSH agent:

$ ssh-add path/to/mykey

Enter passphrase for path/to/mykey: 

Identity added: path/to/mykey (bojan@xyz.com)

To push public key to the remote Linux machine:

References

Generating a new SSH key and adding it to the ssh-agent - GitHub Docs

A brief guide to cryptosystems

Cryptosystem Functions

• Privacy/confidentiality: Ensuring that no one can read the message except the intended receiver.
• Authentication: The process of proving one's identity.
• Integrity: Assuring the receiver that the received message has not been altered in any way from the original.
• Non-repudiation: A mechanism to prove that the sender really sent this message.
• Key exchange: The method by which crypto keys are shared between sender and receiver.

Cryptosystem Algorithms

Each cryptosystem defines three algorithms:

• key(s) generation
• key size (length)
• expiration date
• encryption
• decryption

 

Deterministic algorithm 

• given a particular input it will always produce the same output
• the underlying machine will always be passing through the same sequence of states

 

Block cipher

• deterministic algorithm operating on fixed-length groups of bits, called blocks. 
• consists of two paired algorithms, one for encryption, E, and the other for decryption, D.
• Both algorithms accept two inputs: an input block of size n bits and a key of size k bits; and both yield an n-bit output block.
• The decryption algorithm D is defined to be the inverse function of encryption
  

Cryptosystem types

• Symmetric Encryption (Secret Key Cryptography)
• Uses a single key for both encryption and decryption
• Sender uses the key to encrypt the plaintext and sends the ciphertext to the receiver. The receiver applies the same key to decrypt the message and recover the plaintext.
• Key must be known to both the sender and the receiver; key is the secret
• Applications which use this type of encryption to securely store data can use user-supplied password as a key (or key gets generated from a password)
  
• Same key/password is used to encrypt and decrypt content, which is helpful from a usability standpoint.
  
• The biggest difficulty with this approach is the distribution of the key
• Used for:
• privacy/confidentiality
• Types:
• stream ciphers
• block ciphers
• Algorithms:
• Advanced Encryption Standard (AES, Rijndael; NIST 2001)
• variant of the Rijndael block cipher 
• Rijndael is a family of ciphers with different key and block sizes.
• For AES, NIST selected three members of the Rijndael family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 (AES256) bits. 
• Examples: Ansible Vault uses AES256
   
• ...

• Asymmetric Encryption (Public Key Cryptography)
• Uses one key for encryption and another for decryption
• Used for:
• authentication
• non-repudiation
• key exchange
• Algorithms:
• RSA (Rivest, Shamir and Adleman) (PKCS#1) 
• Diffie–Hellman key exchange protocol
• PGP
• GPG (GnuPG)
• SSL/TLS
• SSH
• ...

• Hash Functions (Message Digests, One-way Encryption)
• Use a mathematical transformation to irreversibly "encrypt" information, providing a digital fingerprint
• Use no key 
• Fixed-length hash value is computed based upon the plaintext that makes it impossible for either the contents or length of the plaintext to be recovered
• Used for:
• message integrity. Examples:
• ensure the integrity of a file; provide a digital fingerprint of a file's contents, often used to ensure that the file has not been altered by an intruder or virus
• encrypt passwords
• Algorithms:
• Message Digest (MD) algorithms
• byte-oriented algorithms that produce a 128-bit hash value from an arbitrary-length message
• Algorithms:
• MD2
• MD4
• MD5
• weaknesses in the algorithm were demonstrated
• Secure Hash Algorithm (SHA)
• SHA-1
• produces a 160-bit hash value
• deprecated by NIST
• SHA-2
• SHA-1 plus
• SHA-224
• SHA-256
• produces a 256-bit (32-byte) hash value, typically rendered as a hexadecimal number, 64 digits long
• SHA-384
• SHA-512
• SHA-3
•  Keccak 

Resources:

Gary C. Kessler - An Overview of Cryptography

http://www.keylength.com/

emc - PKCS
MD5, SHA1, SHA224, SHA256, SHA384, SHA512 and RIPEMD160 hash generator
Advanced Encryption Standard - Wikipedia